CVE-2022-43852 - Vulnerability Details - OpenCVE

IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Aspera Console

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7169766

History

Tue, 15 Apr 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 14 Apr 2025 20:45:00 +0000

Type	Values Removed	Values Added
Description		IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system.
Title		IBM Aspera Console information disclosure
First Time appeared		Ibm Ibm aspera Console
Weaknesses		CWE-497
CPEs		cpe:2.3:a:ibm:aspera_console:3.4.0:::::::* cpe:2.3:a:ibm:aspera_console:3.4.4:::::::*
Vendors & Products		Ibm Ibm aspera Console
References		https://www.ibm.com/support/pages/node/7169766
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-04-14T20:33:58.704Z

Updated: 2025-04-14T20:49:50.025Z

Reserved: 2022-10-26T15:46:22.822Z

Link: CVE-2022-43852

Vulnrichment

Updated: 2025-04-14T20:49:46.179Z

NVD

Status : Awaiting Analysis

Published: 2025-04-14T21:15:17.167

Modified: 2025-04-15T18:39:27.967

Link: CVE-2022-43852

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-43852", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2022-10-26T15:46:22.822Z", "datePublished": "2025-04-14T20:33:58.704Z", "dateUpdated": "2025-04-14T20:49:50.025Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Aspera Console", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.4.4", "status": "affected", "version": "3.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Aspera Console 3.4.0 through 3.4.4 <span style=\"background-color: rgb(255, 255, 255);\">could disclose sensitive information in HTTP headers that could be used in further attacks against the system.</span>"}], "value": "IBM Aspera Console 3.4.0 through 3.4.4\u00a0could disclose sensitive information in HTTP headers that could be used in further attacks against the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-04-14T20:35:52.831Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7169766"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Aspera Console information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T20:49:42.866383Z", "id": "CVE-2022-43852", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T20:49:50.025Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-43852", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2022-10-26T15:46:22.822Z", "datePublished": "2025-04-14T20:33:58.704Z", "dateUpdated": "2025-04-14T20:49:50.025Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Aspera Console", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.4.4", "status": "affected", "version": "3.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Aspera Console 3.4.0 through 3.4.4 <span style=\"background-color: rgb(255, 255, 255);\">could disclose sensitive information in HTTP headers that could be used in further attacks against the system.</span>"}], "value": "IBM Aspera Console 3.4.0 through 3.4.4\u00a0could disclose sensitive information in HTTP headers that could be used in further attacks against the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-04-14T20:35:52.831Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7169766"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Aspera Console information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-43852", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T20:49:42.866383Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T20:49:46.179Z"}}]}}